Extracted

• • Target

    6c6a6136030cabb7f08e8d2df789cbc2.exe

  • Size

    2.2MB

  • MD5

    6c6a6136030cabb7f08e8d2df789cbc2

  • SHA1

    b55dbf0e29bfd61ec9092f62420f9c08275974b9

  • SHA256

    402ff605d7f23f20e253e13b8cb1eb7b5b763a00311deba3cf13c9646ae1f397

  • SHA512

    afeca3d130e1af378faac023718b03ba5d45b8a5307b4b0f2b8081ffe8b85f95b7201f3932bfc9e9c05519ef6ccd64a79e34de9e5cd8f775fee126baeb61877a

  • SSDEEP

    49152:KHlAEi8etVYMUgCHhvcULUuNLP31VmRLVSQE2sCpdN:KHlJWYMfCHt4uVlVkICpdN

  Score

  10^/10

  riseproevasionstealerthemidatrojan

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2